Attacks other than application level attacks usually fail to get through SPI firewalls.

• A. True
• B. False
• C. Sometimes
• D. Not applicable

Answer: (A)

Stateful inspection checks that every packet belongs to an active, valid connection and follows the protocol’s expected behavior. Because of that, many attacks that operate at the network or transport level—things like spoofed packets, invalid flag combinations, or out-of-sequence segments—are dropped because they don’t fit a legitimate connection state. This makes non-application-layer attacks usually unable to pass through SPI firewalls. Attacks that target the application layer, however, rely on inspecting the actual payload and how the application processes it; SPI alone often doesn’t deeply inspect payloads, so those attacks can slip through unless you add deeper application-layer defenses like proxies or DPI.